---
title: "Microsoft Entra"
description: "Connect Microsoft Entra so your team can sign in to Davner with their work accounts."
canonical_url: "https://davner.com/docs/organization/sso/microsoft-entra"
type: "doc"
---

Source: https://davner.com/docs/organization/sso/microsoft-entra

Connect Microsoft Entra so your team can sign in to Davner with their work accounts. Your IT administrator will create an application in Entra, choose who has access, and connect it to Davner.

## Before you start

- Sign in to Davner as an **admin** or **owner**, open **Organization → Settings**, and select [Set up SSO](https://davner.com/app/organization/sso).
- Work with your IT administrator to create the Entra application and choose who should have access.
- Keep Davner's SSO settings open while you work in Entra.

In Davner, enter your team's email domain in the connection's **Domain** field. Separate multiple domains with commas if they use the same Entra tenant. Do this before copying the **Reply URL (ACS URL)** into Entra.

## Configure Microsoft Entra

1. **Open Enterprise applications**

    Open the [Microsoft Entra admin center](https://entra.microsoft.com) and select **Enterprise apps** under **Entra ID**.

    ![Microsoft Entra home with Enterprise apps highlighted.](https://davner.com/docs/blume-assets/content/_/4f7f45e8e6e40e71.png)

2. **Create a new application**

    On the **Enterprise applications** page, select **New application**.

    ![Enterprise applications list with New application highlighted.](https://davner.com/docs/blume-assets/content/_/cde50ad8bac6be9a.png)

3. **Create your own application**

    Select **Create your own application** and name it **Davner**. Choose **Integrate any other application you don't find in the gallery (Non-gallery)**, then select **Create**.

    ![Create your own application panel with the Davner name, non-gallery option, and Create button highlighted.](https://davner.com/docs/blume-assets/content/_/9dc73a8b5deed470.png)

4. **Choose who can access Davner**

    Open **Properties** in the Davner enterprise application. **Assignment required?** controls whether access is limited to selected users and groups or available across your Entra organization. See [Microsoft's documentation](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/application-properties#assignment-required) for details.

    ![Microsoft Entra's Davner application properties with Assignment required set to Yes and highlighted.](https://davner.com/docs/blume-assets/content/_/214b4cdff4d827a3.png)

    **Everyone in your organization**

    Set **Assignment required?** to **No** and select **Save**. Users in your Entra organization can sign in without individual or group assignments.

    **Selected users and groups**

    Set **Assignment required?** to **Yes** and select **Save** if you changed it. Then assign the people who should have access:

    1. Return to the application's **Overview** page, then select **Assign users and groups**.

       ![Davner enterprise application overview with Assign users and groups highlighted.](https://davner.com/docs/blume-assets/content/_/dc476bf5c1d8f8b8.png)

    2. Select **Add user/group**.

       ![Users and groups page with Add user/group highlighted.](https://davner.com/docs/blume-assets/content/_/cdbee643595d274c.png)

    3. Under **Users and groups**, select **None Selected**.

       ![Add Assignment panel with None Selected highlighted.](https://davner.com/docs/blume-assets/content/_/167ce598e158b4d5.png)

    4. Choose the users or groups that need access to Davner. Select **Select**, then **Assign**.

       ![User and group selection list with the Select button highlighted.](https://davner.com/docs/blume-assets/content/_/6f880911b3f196cf.png)

    :::warning[Assigning access through groups]
    Assign groups that contain the users directly; Entra doesn't grant application access through nested groups. Group-based assignment requires Microsoft Entra ID P1 or P2. See [Microsoft's assignment guidance](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal?pivots=portal) for details.
    :::

5. **Choose SAML for single sign-on**

    Open **Single sign-on** in the Davner enterprise application's menu and select **SAML**.

    ![Single sign-on page with the menu entry and SAML option highlighted.](https://davner.com/docs/blume-assets/content/_/d508800ae7cc4672.png)

6. **Edit the basic SAML configuration**

    In **Basic SAML Configuration**, select **Edit**.

    ![SAML setup page with Edit in Basic SAML Configuration highlighted.](https://davner.com/docs/blume-assets/content/_/c59aa7af47b06101.png)

7. **Copy the Davner connection values into Entra**

    Copy the values displayed for your connection in Davner's SSO settings into the matching Entra fields:

    | Microsoft Entra field | Value from Davner |
    | --- | --- |
    | Identifier (Entity ID) | **Identifier (Entity ID)** — `https://davner.com`. |
    | Reply URL (Assertion Consumer Service URL) | The full **Reply URL (ACS URL)** displayed for this connection. |

    Select **Save** in Entra after entering the values.

    ![Basic SAML Configuration panel with Add identifier and Add reply URL highlighted.](https://davner.com/docs/blume-assets/content/_/923327c43a44f999.png)

8. **Copy Entra's metadata URL into Davner**

    In Entra's **SAML Certificates** section, copy the **App Federation Metadata Url**.

    ![SAML Certificates section with App Federation Metadata Url highlighted.](https://davner.com/docs/blume-assets/content/_/ef7ff7f113032dee.png)

    Return to Davner's SSO settings. Under **Metadata URL**, paste it into **App Federation Metadata URL**.

9. **Save the connection and verify your domain**

    Confirm the **Domain** field contains the email domain or domains your team uses. Separate multiple domains with commas if they share this Entra tenant.

    Select **Save and request activation**. You'll see **Pending activation**. [Contact us](https://davner.com/contact) so we can verify ownership of the domains. We'll let you know when the connection is active, usually within a business day.

10. **Test with a team member**

    Once Davner shows **SSO is active**, have a regular team member sign in at [davner.com/login](https://davner.com/login) using an email address at a verified domain.

    If **Assignment required?** is **Yes**, check that an assigned team member can sign in and an unassigned team member cannot. Use regular accounts for this check, since Entra Global Administrators can sign in regardless of assignment.

    Davner creates their account when they first sign in and adds them to your organization as a **Member**.

## Connect another Entra tenant

If your organization uses more than one Entra tenant, select **Add another connection** in Davner and repeat these steps for that tenant. Each connection has its own domains and Reply URL, so copy the values shown for the connection you're setting up.